The vulnerability arises when user input passed through the 'key' GET parameter to /admin/index.php is used directly in OS command execution without proper sanitization. This flaw allows an attacker who does not need authentication to inject and run arbitrary operating‑system commands with root privileges on the server. The weakness corresponds to a command injection flaw (CWE‑78) and could fully compromise system integrity, confidentiality and availability.

Control Web Panel is affected. All installations prior to version 0.9.8.1209 are vulnerable. The attack requires the presence of Softaculous or SitePad, which must be installed for the flaw to be exploitable.

Because the flaw grants root‑level command execution, the potential impact is catastrophic. The CVSS score of 7.3 denotes a high severity. An EPSS score of 32% indicates a moderate probability of exploitation, but the attack vector is an unauthenticated HTTP request to the API endpoint. The vulnerability is not listed in the CISA KEV catalog, but its criticality warrants immediate attention.